According to TechCrunch, Facebook has gotten a “revised” preliminary ruling from its key EU privacy regulator, which could affect its ability to continue exporting user data to the US. “Meta has 28 days to submit comments on this preliminary decision, after which we will formulate an Article 60 decision for other Concerned Supervisory Authorities,” says the statement (CSAs). “I expect this will happen in April,” Graham Doyle, a deputy commissioner at the Irish Data Protection Commission (DPC), told me.
Doyle remained tight-lipped about the preliminary decision’s details. According to a Wall Street Journal report at the time, the DPC sent a preliminary order instructing Facebook to cease data transfers in September 2020, citing persons familiar with the situation.
In calls with investors, Meta, as the internet giant has just dubbed its data-mining business, has been highlighting the persistent risk to its EU-US data flows. It also promptly sought to have the DPC’s earlier draft order challenged in court, but that legal route was blocked in May of last year when the Irish High Court dismissed the appeal to the DPC proceedings.
It’s unclear whether the facts of the case, which revolves around a clash between European data protection law and US surveillance powers, have changed significantly since the earlier draft order ordering the company to suspend transfers, leading the regulator to reach a different conclusion now, regardless of what Meta submits at this stage. Furthermore, in recent months, other European data protection organizations have issued decisions against other US services that include personal data transfers to the US, such as Google Analytics, increasing the pressure on the DPC to issue a decision against Meta, at least from an optics standpoint.
The regulator also faced a procedural challenge from the original complainant, Max Schrems, who obtained an agreement from it in January 2021 that it would quickly finish the long-running complaint — so there’s a second quasi-deadline in play. The DPC consented to hear Schrems in its (parallel) “own volition” procedure, which it began in addition to its complaint-based investigation into his original (2013) complaint, and which is now moving forward thanks to this new preliminary ruling issued to Meta.
Schrems said that he had received the DPC’s ruling, but declined to comment further. (For more twists, in November, Schrems’ privacy advocacy group filed a criminal corruption charge against the DPC, accusing the regulator of “procedural coercion” in regard to attempts to keep other draft complaints from being published…)
It’s unclear how long this multi-year data transfer issue will stretch on before Meta receives a definitive decision, which could order it to halt transfers. However, it should now be closer to months than years. Other interested data protection agencies can make reasoned objections to a draft decision by a lead authority under the Article 60 process, which gives them a month to do so. Extensions are possible, though.
And if there is significant dispute between DPAs over a preliminary decision, the full decision-making procedure can take months longer – and may eventually compel the European Data Protection Board to intervene and force a final conclusion. All of that is yet to come; for now, the ball is in Meta’s court to see what new nonsense its lawyers can concoct.
